Vulnerability-Lookup

CVE-2026-48591 (GCVE-0-2026-48591)

Vulnerability from cvelistv5 – Published: 2026-06-17 16:42 – Updated: 2026-06-18 04:45

Title

Stored XSS via unescaped HTML attribute values in earmark

Summary

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser. The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx. This issue affects earmark from 1.4.1 onward.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 18:25 UTC

CWE

CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 347 records in the last 180 days details

References

2 references

URL	Tags
https://cna.erlef.org/cves/CVE-2026-48591.html	relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-48591	related

Impacted products

2 products

Vendor	Product	Version	CPE status
pragdave	earmark	Affected: 1.4.1 , < * (semver) cpe:2.3:a:pragdave:earmark::::::::
pragdave	earmark	Affected: 8236a0570bd894b50e360da08131ec3294c20799 , < * (git) cpe:2.3:a:pragdave:earmark::::::::

Credits

Peter Ullrich Robert Dober Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T18:25:40.841347Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T18:25:55.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Earmark.Transform\u0027"
          ],
          "packageName": "earmark",
          "packageURL": "pkg:hex/earmark",
          "product": "earmark",
          "programFiles": [
            "lib/earmark/transform.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
            }
          ],
          "repo": "https://github.com/pragdave/earmark",
          "vendor": "pragdave",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "1.4.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Earmark.Transform\u0027"
          ],
          "packageName": "pragdave/earmark",
          "packageURL": "pkg:github/pragdave/earmark",
          "product": "earmark",
          "programFiles": [
            "lib/earmark/transform.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
            }
          ],
          "repo": "https://github.com/pragdave/earmark",
          "vendor": "pragdave",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "8236a0570bd894b50e360da08131ec3294c20799",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "1.4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Robert Dober"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.Earmark.Transform\u0027:_make_att1/2\u003c/tt\u003e in \u003ctt\u003elib/earmark/transform.ex\u003c/tt\u003e splices attribute values verbatim between two literal \u003ctt\u003e\"\u003c/tt\u003e bytes: \u003ctt\u003e[\" \", name, \"=\\\"\" , value, \"\\\"\"]\u003c/tt\u003e. Text nodes are routed through the existing escape function which encodes \u003ctt\u003e\"\u003c/tt\u003e as \u003ctt\u003e\u0026amp;quot;\u003c/tt\u003e, but attribute values never visit that path. A markdown link whose URL or title contains a bare \u003ctt\u003e\"\u003c/tt\u003e closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, \u003ctt\u003e[click](http://example.com/?a=x\" onerror=\"alert(1))\u003c/tt\u003e renders as \u003ctt\u003e\u0026lt;a href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u0026gt;click\u0026lt;/a\u0026gt;\u003c/tt\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\u003c/p\u003e\u003cp\u003eThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\u003c/p\u003e\u003cp\u003eThis issue affects earmark from 1.4.1 onward.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-243",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-243 XSS Targeting HTML Attributes"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T04:45:59.864Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "related",
            "third-party-advisory"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stored XSS via unescaped HTML attribute values in earmark",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMigrate to a maintained Markdown library such as \u003ca href=\"https://hex.pm/packages/mdex\"\u003eMDEx\u003c/a\u003e. The earmark package has been retired on Hex and no patched release will be made.\u003c/p\u003e"
            }
          ],
          "value": "Migrate to a maintained Markdown library such as MDEx (https://hex.pm/packages/mdex). The earmark package has been retired on Hex and no patched release will be made."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48591",
    "datePublished": "2026-06-17T16:42:37.508Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-06-18T04:45:59.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48591",
      "date": "2026-10-30",
      "epss": "0.00133",
      "percentile": "0.02853"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Earmark.Transform\u0027"
                ],
                "packageName": "earmark",
                "packageURL": "pkg:hex/earmark",
                "product": "earmark",
                "programFiles": [
                  "lib/earmark/transform.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
                  }
                ],
                "repo": "https://github.com/pragdave/earmark",
                "vendor": "pragdave",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "1.4.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Earmark.Transform\u0027"
                ],
                "packageName": "pragdave/earmark",
                "packageURL": "pkg:github/pragdave/earmark",
                "product": "earmark",
                "programFiles": [
                  "lib/earmark/transform.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
                  }
                ],
                "repo": "https://github.com/pragdave/earmark",
                "vendor": "pragdave",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "8236a0570bd894b50e360da08131ec3294c20799",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de script en atributos en una p\u00e1gina web en pragdave earmark permite cross-site scripting almacenado a trav\u00e9s de valores de atributos HTML sin escapar.\n\n\u2019Elixir.Earmark.Transform\u2019:_make_att1/2 en lib/earmark/transform.ex empalma valores de atributos textualmente entre dos bytes literales \u201c: [\u201d \u201c, name, \u201d=\\\u201c\u201d, value, \u201c\\\u201d\u201c]. Los nodos de texto se enrutan a trav\u00e9s de la funci\u00f3n de escape existente que codifica \u201d como \u201c, pero los valores de los atributos nunca pasan por esa ruta. Un enlace de markdown cuya URL o t\u00edtulo contiene un \u201d desnudo cierra el atributo prematuramente y permite que los bytes restantes sean analizados por el navegador como nuevos atributos HTML. Por ejemplo, [click](http://example.com/?a=x\u201c onerror_disabled=\u201dalert(1)) se renderiza como \u003ca href=\u201chttp://example.com/?a=x\u201d onerror_disabled=\u201calert(1)\u201d\u003eclick[/a], ejecutando JavaScript arbitrario en el navegador de la v\u00edctima.\n\nLa biblioteca earmark ya no se mantiene y ha sido retirada de Hex. Ninguna versi\u00f3n parcheada ser\u00e1 lanzada. Todas las versiones desde la 1.4.1 en adelante est\u00e1n afectadas, y los usuarios deber\u00edan migrar a una biblioteca de Markdown mantenida como MDEx.\n\nEste problema afecta a earmark desde la 1.4.1 en adelante."
          }
        ],
        "id": "CVE-2026-48591",
        "lastModified": "2026-10-25T23:10:00.167",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48591",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T18:25:40.841347Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-17T18:18:04.370",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-83"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48591",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-17T18:25:40.841347Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-17T18:25:50.701Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Earmark.Transform\u0027"
              ],
              "packageName": "earmark",
              "packageURL": "pkg:hex/earmark",
              "product": "earmark",
              "programFiles": [
                "lib/earmark/transform.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
                }
              ],
              "repo": "https://github.com/pragdave/earmark",
              "vendor": "pragdave",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "affected",
                  "version": "1.4.1",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Earmark.Transform\u0027"
              ],
              "packageName": "pragdave/earmark",
              "packageURL": "pkg:github/pragdave/earmark",
              "product": "earmark",
              "programFiles": [
                "lib/earmark/transform.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
                }
              ],
              "repo": "https://github.com/pragdave/earmark",
              "vendor": "pragdave",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "affected",
                  "version": "8236a0570bd894b50e360da08131ec3294c20799",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "1.4.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Robert Dober"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.Earmark.Transform\u0027:_make_att1/2\u003c/tt\u003e in \u003ctt\u003elib/earmark/transform.ex\u003c/tt\u003e splices attribute values verbatim between two literal \u003ctt\u003e\"\u003c/tt\u003e bytes: \u003ctt\u003e[\" \", name, \"=\\\"\" , value, \"\\\"\"]\u003c/tt\u003e. Text nodes are routed through the existing escape function which encodes \u003ctt\u003e\"\u003c/tt\u003e as \u003ctt\u003e\u0026amp;quot;\u003c/tt\u003e, but attribute values never visit that path. A markdown link whose URL or title contains a bare \u003ctt\u003e\"\u003c/tt\u003e closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, \u003ctt\u003e[click](http://example.com/?a=x\" onerror=\"alert(1))\u003c/tt\u003e renders as \u003ctt\u003e\u0026lt;a href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u0026gt;click\u0026lt;/a\u0026gt;\u003c/tt\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\u003c/p\u003e\u003cp\u003eThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\u003c/p\u003e\u003cp\u003eThis issue affects earmark from 1.4.1 onward.\u003c/p\u003e"
                }
              ],
              "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-243",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-243 XSS Targeting HTML Attributes"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-83",
                  "description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-18T04:45:59.864Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "related",
                "third-party-advisory"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Stored XSS via unescaped HTML attribute values in earmark",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMigrate to a maintained Markdown library such as \u003ca href=\"https://hex.pm/packages/mdex\"\u003eMDEx\u003c/a\u003e. The earmark package has been retired on Hex and no patched release will be made.\u003c/p\u003e"
                }
              ],
              "value": "Migrate to a maintained Markdown library such as MDEx (https://hex.pm/packages/mdex). The earmark package has been retired on Hex and no patched release will be made."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-48591",
        "datePublished": "2026-06-17T16:42:37.508Z",
        "dateReserved": "2026-05-22T09:36:56.834Z",
        "dateUpdated": "2026-06-18T04:45:59.864Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48591

Vulnerability from fkie_nvd - Published: 2026-06-17 18:18 - Updated: 2026-10-25 23:10

Severity

4.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-48591.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-48591

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Earmark.Transform\u0027"
          ],
          "packageName": "earmark",
          "packageURL": "pkg:hex/earmark",
          "product": "earmark",
          "programFiles": [
            "lib/earmark/transform.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
            }
          ],
          "repo": "https://github.com/pragdave/earmark",
          "vendor": "pragdave",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "1.4.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Earmark.Transform\u0027"
          ],
          "packageName": "pragdave/earmark",
          "packageURL": "pkg:github/pragdave/earmark",
          "product": "earmark",
          "programFiles": [
            "lib/earmark/transform.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
            }
          ],
          "repo": "https://github.com/pragdave/earmark",
          "vendor": "pragdave",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "8236a0570bd894b50e360da08131ec3294c20799",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de script en atributos en una p\u00e1gina web en pragdave earmark permite cross-site scripting almacenado a trav\u00e9s de valores de atributos HTML sin escapar.\n\n\u2019Elixir.Earmark.Transform\u2019:_make_att1/2 en lib/earmark/transform.ex empalma valores de atributos textualmente entre dos bytes literales \u201c: [\u201d \u201c, name, \u201d=\\\u201c\u201d, value, \u201c\\\u201d\u201c]. Los nodos de texto se enrutan a trav\u00e9s de la funci\u00f3n de escape existente que codifica \u201d como \u201c, pero los valores de los atributos nunca pasan por esa ruta. Un enlace de markdown cuya URL o t\u00edtulo contiene un \u201d desnudo cierra el atributo prematuramente y permite que los bytes restantes sean analizados por el navegador como nuevos atributos HTML. Por ejemplo, [click](http://example.com/?a=x\u201c onerror_disabled=\u201dalert(1)) se renderiza como \u003ca href=\u201chttp://example.com/?a=x\u201d onerror_disabled=\u201calert(1)\u201d\u003eclick[/a], ejecutando JavaScript arbitrario en el navegador de la v\u00edctima.\n\nLa biblioteca earmark ya no se mantiene y ha sido retirada de Hex. Ninguna versi\u00f3n parcheada ser\u00e1 lanzada. Todas las versiones desde la 1.4.1 en adelante est\u00e1n afectadas, y los usuarios deber\u00edan migrar a una biblioteca de Markdown mantenida como MDEx.\n\nEste problema afecta a earmark desde la 1.4.1 en adelante."
    }
  ],
  "id": "CVE-2026-48591",
  "lastModified": "2026-10-25T23:10:00.167",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48591",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-17T18:25:40.841347Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-17T18:18:04.370",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-83"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-52MM-H59V-F3C7

Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-18 14:47

Summary

earmark: Stored XSS via unescaped HTML attribute values

Details

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.

'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, click.

The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.

This issue affects earmark from 1.4.1 onward.

Severity

4.8 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "earmark"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.1"
            },
            {
              "last_affected": "1.5.0-pre1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-83"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:47:16Z",
    "nvd_published_at": "2026-06-17T18:18:04Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward.",
  "id": "GHSA-52mm-h59v-f3c7",
  "modified": "2026-06-18T14:47:16Z",
  "published": "2026-06-17T18:35:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48591"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pragdave/earmark"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "earmark: Stored XSS via unescaped HTML attribute values"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-48591 (GCVE-0-2026-48591)

FKIE_CVE-2026-48591

GHSA-52MM-H59V-F3C7

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour